Blackholing

Blackholing is a technique for denying a route to your machine for a particular ip address or domain. This is useful if a particular machine is annoying you and you cannot/have not yet gotten their ISP to remove them.

Exact syntax varies from system to system; on later Linux systems the following may work:

ipfwadm -Ii deny -P tcp -S ${ATTACKER_IP}/32 -D 0/0

ipfwadm -Ii deny -P udp -S ${ATTACKER_IP}/32 -D 0/0

On other systems the following may work:

route add ${ATTACKER_IP} reject

This may be used with TjL's deny.sh script to automatically disconnect persistant abusers.

Up to Security Page